In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libarchive-devel | May 4, 2022 | Nov 21, 2019 |
| Alpine Linux | — | Upgrade libarchive | Mar 24, 2020 | Nov 21, 2019 |
| Centos_linux | — | Upgrade libarchive-debuginfoUpgrade bsdcat-debuginfoUpgrade libarchive-debugsourceUpgrade libarchiveUpgrade bsdtar-debuginfoUpgrade bsdcpio-debuginfoUpgrade bsdtar | Nov 5, 2020 | Nov 21, 2019 |
| Debian | — | Upgrade libarchive | May 2, 2022 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libarchive | Nov 3, 2020 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libarchive | Sep 28, 2020 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libarchive | Jun 3, 2020 | Nov 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libarchive-develUpgrade bsdtarUpgrade libarchive | Feb 26, 2020 | Nov 21, 2019 |
| Oracle Solaris | — | Upgrade library/libarchive to version 3.4.1-11.4.19.0.1.1.0 on Solaris 11.4 | Jan 19, 2021 | Nov 21, 2019 |
| Oracle_linux | — | Upgrade bsdtarUpgrade libarchiveUpgrade libarchive-devel | Nov 12, 2020 | Nov 21, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Mar 12, 2021 | Nov 21, 2019 |
| Redhat_linux | — | No solution existsUpgrade bsdtarUpgrade bsdtar-debuginfoUpgrade libarchive-debugsourceUpgrade libarchiveUpgrade libarchive-debuginfoUpgrade libarchive-develUpgrade bsdcat-debuginfoUpgrade bsdcpio-debuginfo | Nov 5, 2020 | Nov 21, 2019 |
| Suse | — | Upgrade bsdtarUpgrade libarchive13Upgrade libarchive-devel | Nov 18, 2021 | Nov 21, 2019 |
| Ubuntu | — | Upgrade libarchive13Upgrade libarchive13 (Ubuntu Pro)Upgrade libarchive-dev (Ubuntu Pro)Upgrade bsdtar (Ubuntu Pro)Upgrade bsdcpio (Ubuntu Pro) | Mar 3, 2020 | Nov 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub